What is GHSA-9xw5-w5jj-pvcg?

GHSA-9xw5-w5jj-pvcg is a security advisory published by GitHub Security Advisories with High severity. AIOHTTP: File descriptor exhaustion in multipart requests

Which CVE IDs does GHSA-9xw5-w5jj-pvcg cover?

GHSA-9xw5-w5jj-pvcg covers the following CVE IDs: CVE-2026-111066. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-9xw5-w5jj-pvcg?

GHSA-9xw5-w5jj-pvcg affects 1 product, including: pip/aiohttp:\u003e= 2.0.0, \u003c 3.14.4.

GHSA-9xw5-w5jj-pvcgHigh

AIOHTTP: File descriptor exhaustion in multipart requests

Vendor

GitHub Security Advisories

Published

October 20, 2026

Last Modified

October 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-111066 →

📋 Description

Summary

An attacker can exhaust file descriptors with specially crafted multipart requests.

Impact

If a handler uses Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.

🎯 Affected products1

pip/aiohttp:>= 2.0.0, < 3.14.4

🔗 References (5)

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg
https://nvd.nist.gov/vuln/detail/CVE-2026-111066
https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
https://github.com/advisories/GHSA-9xw5-w5jj-pvcg